External risk intelligence

Flowise RCE via Unvalidated MCP Node Input

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-59528

Flowise is a web-based, drag-and-drop interface platform designed for building and managing workflows. Such applications are commonly deployed as web services, APIs, or management portals to allow collaborative access to LLM flow orchestration, making them frequently internet-facing or accessible through internal networks where they serve as primary interaction points for users.

Code Injection

Flowiseai Flowise

3.0.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Flowise, a tool used for building large language model workflows, specifically in its handling of user-provided configuration for connecting to external servers. This flaw allows for the execution of arbitrary JavaScript code, potentially granting attackers full control over the system running Flowise. The issue has been addressed in a subsequent version of the software.

Allows remote code execution in workflow tool.
Matters for securing LLM development platforms.
Confirm relevance and ensure the tool is updated.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted configuration data to a vulnerable Flowise instance. This data is processed by a component that executes unvalidated JavaScript code, allowing the attacker to run commands on the server with full Node.js privileges. This can lead to a complete compromise of the affected system.

Unauthenticated network access required.
User input to `Function()` constructor.
Server-side code execution.

Live Threat

Current exploitation, exposure, and threat context

When an unauthenticated attacker can provide a malicious configuration string to the CustomMCP node, it can lead to remote code execution with full Node.js runtime privileges. This could allow an attacker to access sensitive system modules and potentially compromise the entire server.

System data and service behavior at risk.
Remote code execution via malicious configuration.
Complete server compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability, as Flowise is a user interface for building LLM flows. The first practical step is to identify all instances of Flowise, confirm their accessibility and criticality, and then assign an owner for remediation planning.

Flowise application owners.
Verify Flowise instance reachability.
Plan for version upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a visual platform that enables users to construct and manage workflows for large language models through a drag-and-drop interface. It functions as a development tool that orchestrates how models interact with data and external services, often acting as a centralized hub for LLM-based automation and application building.

What does CWE-94 mean in the context of CVE-2025-59528?

CWE-94 refers to Improper Control of Generation of Code, also known as Code Injection. In this vulnerability, the software takes user-provided strings for configuring the CustomMCP node and processes them in a way that executes the input as live JavaScript code. Because this happens within the server's Node.js runtime, the application essentially treats untrusted configuration data as valid, executable commands.

How is this vulnerability triggered?

An attacker triggers this by submitting a specially crafted configuration string to the CustomMCP component. The vulnerability is specifically caused by passing this input into a Function constructor without any security checks. Simply using the application for standard workflow design does not trigger the bug; the system only becomes compromised when the specific, malformed configuration input is provided to the vulnerable function.

Is my Flowise instance at risk?

If your instance is reachable via a network, it is at higher risk. Halo Surface Signal identifies Flowise as a web-based platform often deployed as an API or management portal. Because these services are frequently designed for collaborative access, they are often placed in environments where they are exposed to the internet or wide internal networks, making them primary targets for unauthorized input.

What is the first step to address this CVE?

You should verify the version of Flowise running in your environment. Since the vulnerability was addressed in version 3.0.6, the primary path to remediation is planning an upgrade to that version or higher. Start by locating all active instances of Flowise, documenting their network accessibility, and scheduling an update to remove the vulnerable code path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.